# S1ngularity - What Happened, How We Responded, What We Learned

DevFeed: [S1ngularity - What Happened, How We Responded, What We Learned](<https://devfeed.tech/articles/s1ngularity-what-happened-how-we-responded-what-we-learned-21447.md>)

Original publisher: [Read original article](<https://nx.dev/blog/s1ngularity-postmortem>)

Author: Juri Strumpflohner

Published: 2025-09-05T00:00:00Z

Content type: article

Language: en

Sources: [Juri Strumpflohner](<https://devfeed.tech/sources/juri-strumpflohner.md>)

Topics: [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [npm](<https://devfeed.tech/topics/npm.md>), [malicious packages](<https://devfeed.tech/topics/malicious-packages.md>), [Security](<https://devfeed.tech/topics/security.md>), [Exploit](<https://devfeed.tech/topics/exploit.md>), [incident](<https://devfeed.tech/topics/incident.md>), [Command-line interface](<https://devfeed.tech/topics/cli.md>), [Local AI](<https://devfeed.tech/topics/local-ai.md>), [Claude](<https://devfeed.tech/topics/claude.md>)

Tags: [claude](<https://devfeed.tech/tags/claude.md>), [cli](<https://devfeed.tech/tags/cli.md>), [exploit](<https://devfeed.tech/tags/exploit.md>), [gemini](<https://devfeed.tech/tags/gemini.md>), [github](<https://devfeed.tech/tags/github.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [incident](<https://devfeed.tech/tags/incident.md>), [local-ai](<https://devfeed.tech/tags/local-ai.md>), [malicious-packages](<https://devfeed.tech/tags/malicious-packages.md>), [npm](<https://devfeed.tech/tags/npm.md>), [nx](<https://devfeed.tech/tags/nx.md>), [reporting](<https://devfeed.tech/tags/reporting.md>), [security](<https://devfeed.tech/tags/security.md>), [signing](<https://devfeed.tech/tags/signing.md>)

## AI overview

Nx describes how attackers exploited a GitHub Actions injection vulnerability to steal its npm publishing token and publish malicious Nx packages. The packages ran post-install scripts that searched for sensitive data and uploaded results to public GitHub repositories. The article also details containment, communication, investigation, and security hardening measures.

## Source excerpt

Malicious Nx packages were published to npm via GitHub Actions exploit. Learn what happened and how we enhanced security measures.